如何在Python中加载原始字节格式的2048位DH公钥派生共享密钥

API 探路者

2026-6-29

问题

我用C代码生成了原始字节格式的2048位Diffie-Hellman密钥对，通过TCP/IP Socket把公钥发送到Python服务器，该公钥的字节数据如下：

derive_key_dh_public_value = {
    0x46, 0x3b, 0x61, 0x4, 0x74, 0x26, 0x81, 0x71, 0xee, 0xba, 0x8b, 0xe, 0xe, 0x34, 0xd, 0x39,
    0x8f, 0xb3, 0xa1, 0x44, 0x63, 0x19, 0x8f, 0x66, 0x6b, 0x80, 0x48, 0x55, 0x8b, 0x96, 0x65, 0x3c,
    0x4a, 0x69, 0x48, 0xbd, 0x65, 0xa5, 0xa5, 0x5c, 0x9, 0x12, 0x30, 0x86, 0xcd, 0x68, 0x11, 0x24,
    0x6, 0x68, 0xb1, 0x36, 0x47, 0x1a, 0x19, 0xb2, 0x5c, 0xb, 0x92, 0x29, 0x2d, 0xa6, 0x1f, 0x22,
    0xc0, 0x36, 0x4e, 0xcd, 0x1, 0x68, 0xcb, 0xd9, 0xd4, 0x1b, 0xae, 0xf9, 0x4b, 0x70, 0x61, 0x7c,
    0x7c, 0xb8, 0x42, 0xf0, 0xaa, 0xd9, 0x5b, 0xd2, 0x37, 0x84, 0x70, 0x1d, 0x18, 0x4a, 0xd4, 0xf3,
    0xac, 0x95, 0x6e, 0xd7, 0xea, 0x70, 0x66, 0xd6, 0x20, 0x27, 0x27, 0xbe, 0x40, 0x62, 0x96, 0xdb,
    0x6e, 0xa7, 0xc4, 0x7, 0xaa, 0x75, 0x86, 0xb5, 0xc9, 0x44, 0xa1, 0xa8, 0x9f, 0xe0, 0xc6, 0x4d,
    0x71, 0x15, 0x80, 0x83, 0x5, 0x5, 0x15, 0xfc, 0xba, 0x56, 0x52, 0xd4, 0x25, 0xcd, 0x75, 0x88,
    0xcc, 0xce, 0x9d, 0x5e, 0xdf, 0xef, 0xc1, 0x58, 0xfc, 0xc6, 0x91, 0xc3, 0xcd, 0x72, 0xfe, 0xa5,
    0x36, 0xdd, 0x68, 0x90, 0x66, 0xea, 0x38, 0x2a, 0x1a, 0x6, 0xb, 0x38, 0xb5, 0xaf, 0x58, 0x7e,
    0x39, 0x9c, 0x6c, 0xab, 0x1f, 0xd5, 0x0, 0xb4, 0x69, 0x63, 0xa4, 0x8b, 0xa3, 0xf1, 0x1e, 0xef,
    0x97, 0x28, 0x32, 0x7a, 0xd0, 0x1c, 0xa3, 0x5d, 0xf, 0x93, 0xa, 0x6b, 0x90, 0x78, 0x6b, 0xf0,
    0x1d, 0xed, 0xeb, 0x85, 0x46, 0x54, 0x76, 0x32, 0x15, 0xbe, 0x96, 0x8e, 0xe2, 0x70, 0x60, 0x16,
    0xae, 0xf7, 0xe5, 0x29, 0xc3, 0x70, 0xf0, 0x6b, 0x4c, 0xb7, 0xf0, 0x7c, 0x7a, 0xc8, 0xee, 0x38,
    0x7f, 0x5d, 0xf4, 0x28, 0x64, 0x94, 0x59, 0x43, 0xcd, 0x57, 0x87, 0x33, 0x7b, 0xae, 0xee, 0xfe
};

Python端已经生成了自己的DH密钥对，现在需要加载这段原始字节格式的DH公钥来派生共享密钥。我尝试了下面的代码但报错：

dh_public_key_base64 = base64.b64encode(received_public_key).decode('utf-8')
print(dh_public_key_base64)
received_public_key = serialization.load_der_public_key(dh_public_key_base64, backend=default_backend())

解决方案

你的错误在于把原始字节公钥转成Base64后直接用load_der_public_key加载——这个方法是用来加载DER编码的公钥结构的，而你手里的只是DH公钥的原始数值字节（大端序），不是标准DER格式。下面用cryptography库给出正确的处理步骤：

转换原始字节为bytes对象
如果从Socket接收到的是字节流，直接使用即可；如果是上面的十六进制列表，先转成bytes：
```
pub_key_bytes = bytes(derive_key_dh_public_value)
```

同步DH参数（必须和C端一致）
DH密钥交换需要两端使用相同的大素数p和生成元g。假设C端使用RFC 3526定义的2048位标准DH参数，Python端可以这样构造：

from cryptography.hazmat.primitives.asymmetric import dh
from cryptography.hazmat.backends import default_backend

# RFC 3526标准2048位DH参数
p = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF
g = 2

parameters = dh.DHParameterNumbers(p, g).parameters(default_backend())

如果C端用的是自定义参数，需要把对应的p和g值同步到Python代码中。

加载原始公钥并生成公钥对象
把原始字节转成大端序整数，再构造DH公钥对象：

from cryptography.hazmat.primitives import serialization

# 字节转大端序整数
pub_key_num = int.from_bytes(pub_key_bytes, byteorder='big')
# 构造公钥实例
peer_public_key = parameters.public_key_from_numbers(dh.DHPublicNumbers(pub_key_num, parameters.parameter_numbers()))

派生共享密钥
用Python端的DH私钥和加载后的对方公钥计算共享密钥：

# 假设已生成自身DH私钥：private_key = parameters.generate_private_key()
shared_key = private_key.exchange(peer_public_key)

内容的提问来源于stack exchange，提问作者Shirin Ebadi